Provably Secure Steganography

1
Provably Secure Steganography
Nick Hopper With Luis von Ahn John Langford
2
SteganographyThe Prisoners Problem
3
Cant they use Encryption?
?
Encrypts JL BRK 2300H to get NM DTQ 0599K
Ward
NM DTQ 0599K
Alice
Bob
4
Cant they use Encryption?
?
Ward
Alice
Bob

• Cryptography only hides the content of a message
• Steganography hides the existence of a message

5
Secure Stegosystem
6
Secure Stegosystem
A Channel , C, is a distribution on a set D of
documents
7
Secure Stegosystem
A Channel , C, is a distribution on a set D of
documents
A Stegosystem S (SE,SD) is a pair of
algorithms
8
Secure Stegosystem
A Channel , C, is a distribution on a set D of
documents
A Stegosystem S (SE,SD) is a pair of
algorithms
SE

• Input
• Key K
• Message m
• Output s in D

9
Secure Stegosystem
A Channel , C, is a distribution on a set D of
documents
A Stegosystem S (SE,SD) is a pair of
algorithms
SE
SD

• Input
• Key K
• s in D
• Output Message m

• Input
• Key K
• Message m
• Output s in D

10
Secure Stegosystem
A Channel , C, is a distribution on a set D of
documents
A Stegosystem S (SE,SD) is a pair of
algorithms
SE
SD

• Input
• Key K
• s in D
• Output Message m

• Input
• Key K
• Message m
• Output s in D

With high probability, SD(K,SE(K,m)) m
11
Secure Stegosystem
A Channel , C, is a distribution on a set D of
documents
A Stegosystem S (SE,SD) is a pair of
algorithms
SE
SD

• Input
• Key K
• s in D
• Output Message m

• Input
• Key K
• Message m
• Output s in D

With high probability, SD(K,SE(K,m)) m
S is secure if output distribution of SE(K,m) for
any m is computationally indistinguishable from C
12
Construction
C
13
Construction
C
Shared Pseudorandom Function
14
Construction
C
FK
FK
FK
1
0
0
1
1
15
Construction
C
FK
FK
FK
majority0
0
0
1
16
Results

• Secure steganography exists if and only if
  one-way functions exist
• Robust Steganography is possible if one-way
  functions exist
• There is a CAPTCHA such that, either the CAPTCHA
  is secure, or robust steganography for images is
  possible.
• Public-Key steganography is possible, under
  widely believed cryptographic assumptions
• Essentially tight upper and lower bounds on the
  maximum rate of a stegosystem